Community discussions

MikroTik App
 
GiovanniG
Member
Member
Topic Author
Posts: 350
Joined: Sun Nov 15, 2015 4:12 pm

Can't access NAT of the same network

Thu Apr 23, 2020 3:55 pm

Hi, it's strange situation, I've different networks on a router, for each one I have some NATs on public IP, if I try to access the publicaddress:natport-on the network A from network A it doesn' work, from network B and C yes. The same for network B, if I try to access the publicaddress:natport-on the network B from network B it doesn' work, from network A and C yes. It looks router can't nat to the same network, and re rute packet. How to overcome this? thank you
Last edited by GiovanniG on Thu Apr 23, 2020 6:06 pm, edited 1 time in total.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19363
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Can't access NAT of the sae network

Thu Apr 23, 2020 4:55 pm

If you connect to your servers using the LANIP address it will work fine.
If you connect from an external user to the server it will work fine.
If you connect to the server FROM WITHIN the same subnet BUT using the WANIP address of the router it will fail.

This is called a hairpin nat situation and requires an additional config.
 
GiovanniG
Member
Member
Topic Author
Posts: 350
Joined: Sun Nov 15, 2015 4:12 pm

Re: Can't access NAT of the sae network

Thu Apr 23, 2020 6:06 pm

thank you for your kind answer, which configuration I need to add?
Becuse there are mobile terminals that connects on LTE, but when under wifi it's better to use wifi.. and without change the address.
If we use a classic router, it works, so I was thinking it won't be that complicated
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11624
Joined: Thu Mar 03, 2016 10:23 pm

Re: Can't access NAT of the same network

Thu Apr 23, 2020 6:24 pm

You need hairpin NAT.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19363
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Can't access NAT of the same network

Fri Apr 24, 2020 3:41 am

I take issue with that article.
Look at the first example!
ip firewall nat
add chain=dstnat dst-address=1.1.1.1 protocol=tcp dst-port=80 \
action=dst-nat to-address=192.168.1.2
add chain=srcnat out-interface=WAN action=masquerade

a. the dstnat rule implies Static FIXED WANIP
b. the source nat rule implies a dynamic WANIP.

Lets say it is case A. then the example should have shown...........
/ip firewall nat
add chain=dstnat dst-address=1.1.1.1 protocol=tcp dst-port=80 \
action=dst-nat to-address=192.168.1.2
add chain=srcnat action=srcnat out-interface=WAN to address=1.1.1.1

Furthermore later on the solution for hairpin is not so smooth. For the fixed WANIP it merely needs an an additional hairpin srcnat rule..
add chain=srcnat action=masquerade dst-address=192.168.1.0/24 src-address=192.168.1.0/24

Who is online

Users browsing this forum: GoogleOther [Bot], maisondasilva, whernandez and 95 guests